Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

The correct answer is D. Child Process Protection. If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes…

Submitted by femi9· Apr 18, 2026Cortex XDR Architecture and Agent Deployment

Question

Options

AHash Verdict Determination
BBehavioral Threat Protection
CRestriction Policy
DChild Process Protection

How the community answered

(42 responses)

A
2% (1)
C
2% (1)
D
95% (40)

Explanation

If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator- Guide/File-Analysis-and-Protection-Flow

Topics

#Cortex XDR Agent#Malware Protection#Protection Flow#Security Modules Order

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice